Versions (4)
Version DetailsCurrent
Rev: 4 • Nov 21, 2014, 12:00 PMET EXPLOIT_KIT Archie EK T2 Landing Struct Nov 20 2014
alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Archie EK T2 Landing Struct Nov 20 2014"; flow:established,to_server; urilen:70; content:".html"; http_uri; offset:65; depth:5; pcre:"/^\/[a-f0-9]{64}\.html$/U"; pcre:"/^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a|\r?\n)/Hmi"; classtype:exploit-kit; sid:2019769; rev:4; metadata:created_at 2014_11_21, confidence High, signature_severity Major, updated_at 2019_07_26;)
Nov 21, 2014, 12:00 PM
Jul 26, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-exploit_kit.rules